BETWEEN November 2025 and March 2026, Eye Security uncovered a threat in Time4Popcorn’s Updater.exe, a background updater for a discontinued Popcorn Time variant. The Updater, running with SYSTEM on Windows and root on macOS, queried abandoned web addresses over unencrypted connections and would install whatever it received, regardless of the sender.
Eye’s investigation—the Operation IXIM write-up and Hack[.]lu talk—found that the updater contacted 20 abandoned domains, yielding millions of distinct hardware IDs and indicating that an unauthorised party could have served their own code to many machines. Eye estimated the scope at roughly 2.5–3 million Windows PCs and 250,000–350,000 Macs, with users worldwide including home systems, government, military, and corporate devices.
The vulnerability was disclosed in June as CVE-2026-30612 and is rated 9.8/10 by the U.S. CISA; it affects Time4Popcorn versions Windows 6.2.1.18 and earlier, Mac 6.2.1.17 and earlier, and Android 3.5.0.173 and earlier.
With no patch available and few defenders able to fix those systems, Eye Security devised a self-updating countermeasure that disables the updater. After legally assessing the approach, Eye deployed an update that stops the updater, deletes no files and collects no data. The move significantly reduced malicious web traffic and prevented botnet or ransomware deployment via the updater, though it did not render the entire Popcorn Time app safe.
By December 2025 over 1 million systems had been updated, and by March 2026 the operation had delivered more than 2 million updates before it ceased. Shadowserver later took control of the associated domains to sinkhole the traffic. For defenders, indicators include Updater.exe on Windows, PT[.]updd on Mac, and the 20 web addresses Eye documented; Android devices remain unpatchable for this updater, as the app itself controls update delivery.